THE INFORMATIONTECHNOLOGY (AMENDMENT) ACT) 2008 

No. 10 OF 2009 



MINISTRY OF LAW AND JUSTICE 
(Legislative Department) 

Ne\jl Delhi, the 5th February. 2009/Magha 16, 1930 (.'SaM) 

The following Act of Parliament received the assent of the President on the 
5th February, 2009, and is hereby published for general information:- 

THEINFORMATIONTECHNOLOGY (AMENDMENT) ACT) 2008 

No. 10 OF 2009 

[5th February. 2009.] 
AnAct furtherto amend the Information Technology Act, 2000. 
BE it enacted by Parliament in the Fifty-ninth Year oftbe Republic oflndia as foUows:- 

PART! 

\ PRELIMINARY 

1. (I) This Act may be called the Information Technology (Amendment) Act, Short tide Slid 

2008. 

(2) 1 1 shall come into force on such dale as the Central Government ma)- by notification 
in the Official Gazette, appoint: 

Provided that different dales may be appointed for different provisions of this Act and 
any reference in any such provision to the commencement ofthls Act shall be construed as 
a reference to the coming into force of that provision. 
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PARTD 

AMENDMENTS TO 'rHE INFORMATION TECHNOLOGY Aer, 2000 

2. In the Information Technology Act, 2000 (hereinafter in this Part referred to as the 21 of 2000. 
principal Act), for the words "digital signature" occurring in the Chapter, section, sub- 
section and clause referred to in the Table below, the words "electronic signature" shall be 
substituted. .... h 

TABU; 

S.No. Cbapter/section/sub-section/clause 

(1 ) clauses (d), (g), (h) and (zg) of section 2; 

(2) section 5 and its marginal heading; 

(3) marginal heading of section 6; 

(4) clauses (a), (b)., (e) and.(e) of section 10 and its marginal heading; 

(5) heading ofChapler V; 

(6) clauses Q) and (g) of section 18; 
(T) sub-section (2) of section 19; 

(8) sub-sections (1 ) and (2) of section 2) and its marginal heading; 

(9) sub-section (3) of section 25; 

(10) clause (c) ofsection 30; 

(11) clauses (0) and (d) of sub-section (1) and sub-section (2) of section 34; 

(12) heading of Chapter VIJ; 

(13) section 35 and its marginal heading; 

(14) section 64; 

(15) section 71; 

(16) sub-section (I) of section 73 and its marginal beading; 

(17) section 74; and 

(18) clauses (d), (n) and (0) of sub-section (2) of section 87. 

3. In section 1 of the principal Act, for sub-section (4), the following sub-sections shall 
be substituted, namely:- 

"(4) Nothing in this Act shall apply to documents or transactions specified in 
the First Schedule: 

Provided that the Central Govemment may. by notification in the Official Gazette, 
amend the First Schedule by way of addition or deletion of entries thereto. 

(5) Every notification issued under sub-section (4) shall be laid before each 
House ofParliameat,". 

4. In section 2 of the principal Act,- 

(A) after clause (b), the following clause shall be inserted, namely:- 

'(hal "communication device" means cell phones, personal digital 

assistance or combination of both or any other device used to communicate, 
send or transJrllt any text, video, audio or image;'; 

(B) for clause (J), the following clause shall be substituted, namely:- 

'()) "computer network" means the inter-conncction of one or more 
computers or computer systems or communication device through- 

(I) the use of satellite, microwave, terrestrial line, wire, wireless or 
other communication media; and 

(il) terminals or a complex consisting of two or more intcr-connected 
computers or communication device whether or not the inter-connection 
is continuously maintained;'; 
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(C) in clause (n), the word "Regulations" shall be omitted; 

(D) after clause (n). the following clauses shall be inserted, namely:- 

'(no) "cyber cafe" means any facility from where access to the internet is 
offered by any person in the ordinary course of business to the members of the 
pubhc; 

(00) "cyber security" means protecting information, equipment, devices, 
computer, computer resource, communication device and information stored 
therein from unauthorised access, use, disclosure, disruption, modification or 

destraction; '. 

(E) after clause (t), Vne following clauses shall be inserted, namely:- 

'ftal "electronic signature" means authentication of any electronic record 
by a subscriber by means of the electronic technique specified in the Second 
Schedule and includes digital signature; 

(fb) "Electronic Signature Certificate" means an Electronic Signature 
Certificate issued under section 35 and includes Digital Signature Certificate;'; 
(f ) after clause (u), the following clause shall be inserted, namely:- 

'(uo) "Indian Computer Emergency Response Team" means an agency 
established under sub-section (I) of section 70B;'; 

(G) in clause (v), for the words "data, text", the words "data, message, text" shall 
be substituted; 

(li) for clause (14% the following clause shall be substituted, namely:- 

'(\r) "intermediary", with respect to any particular electronic records, means 
any person who on behalf of another person receives, stores or transmits that 
record or provides any service with respect io that record and includes telecom 
service providers, network service providers, internet service providers, web- 
hosting service providers, search engines, online payment sites, online-auction 
sites, online-market places and cyber cafes;', 

5. In Chapter PI of the principal Act, for the heading, the heading "DIOITAL signatur,e Amendment of 

Affi) ELECTRONIC SIONATDRi" shall be Substituted. he-idmg of 

ChlptCl 11 

6. After section 3 of the principal Act, the following section shall be inserted, Inseruen o( 
, new seeuon 

namely:- 3^ 

"3Ao (I) Notwithstanding anything contained in section 3, but subject to the EleClrocic 
previsions of sub-section (2). a subscriber may authenticate any electronic record by ^'snature. 
such electronic signature or electronic authentication technique which- 

(a) is considered reliable; and 

(b) may be specified in the Second Schedule. 

(2) For the purposes of this section any electronic signature or electronic 
authentication technique shall be considered reliable if- 

(a) the signature creation data or the authenrication data arc, within the 
contexr in which they are used, linked to the signatory of, as Ihecase may be, the 
authenticator and, to no other person; 

(b) the signature creation data or the authentication data were, at the time 
of signing} under the control of the signatory or, as the case may be, the 
authenticator and of no other person; 

(c) any alteration to the electronic signature made after affixing such 
signature is detectable; 

Cd) any alteration to the information made after its authentication by. 
electronic signature is detectable; and 

(e) it fulfils such other conditions which may be prescribed. 
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(3) The Central Government may prescribe the procedure for the purpose of 
ascertaining whether electronic signature is that oftbe person by whom it is purported 
to have been affixed or authenticated. 

(.f) The Central Government may, by notification in the Official Gazette, add to or 
omit any electronic signature or electronic authentication technique and the procedure 
for affixing sucb signature from the Second Schedule: 

Provided that no electronic signature or authentication technique shall be 
specified in the Second Schedule unless such signature or technique is rehable. 

(5) Every notification issued under sub-section (4) shall be laid before each 
HouseofParliament ". 

7. After section 6 of the principal Act, the following section shall be inserted, namely:- 



'6A. (I) The appropriate Government may, for the purposes of this Chapter and 
for efficient delivery of services to the public through electronic means authorise, by 
order,any service provider to set up. maintain and upgrade the computerised facilities 
and perform such other services as it may specify by notification in the Official 
Gazette. 

ExpJanolion.-For the purposes of chis section, service provider so authorised 
includes any individual, private agency, private company, partnership firm, sole 
proprietor firm or any such other body or agency which has been granted permission 
by the appropriate Government to offer services through electronic means in 
accordance with the policy governing such service sector. 

(2) The appropriate Government may also authorise any service provider 
authorised under sub-section (I) to collect, retain and appropriate such service charges, 
as may be prescribed by the appropriate Government for the purpose of providing 
such services, fi'om the person availing such service. 

(3) Subject to the provisions of sub-section (2), the appropriate Government 
may authorise the service providers to collect, retain and appropriate service charges 
under this section notwirhstanding the fact that there is no express provision under 

theAct, rule, regulation or notification under which the service is provided to collect, 
retain and appropriate e-service charges by the service providers. 

(4) The appropriate Government shall, by notification in the Official Gazette, 
specify the scale of service charges which may be charged and collected by the 
service providers under this section: 

Provided that the appropriate Government may specify different scale of service 
charges for different types of services.'. 

8. After section 7 of the principal Act, the following section shall be inserted, namely:- 



"7 A. Where in any law for the time being in force, there is a provision for audit of 
documents, records or information, that provision shall also be applicable for audit of 
documents, records or information processed and maintanined in the electronic form.". 

\ 



9. After section 
namely:- 



10 of the principal Act, the following section shall be inserted. 



"lOA. Where in a contract formation, the communication of proposals, the 
acceptance of proposals, the revocation of proposals and acceptances, as the case 
may be. are expressed in electronic form or by means of an electronic record, such 
contract shall not be deemed to be unenforceable solely on the ground that such 
electronic form or means was used for that purpose.". 
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10. In section 12 of the principal Act. in sub-section (J), for the words "agreed with the 
addressee", the word "stipulated" shall be substituted. 

11. For sections 15 and 16 of the principal Act, the following sections shall be 
substituted, namely: - 



') S. An electronic signature shall be deemed to be b secure electronic signature 



if- 



f/j the signature creation data, at the time of affixing signature, was under 
the exclusive control of signatory and no other person; and 

(il) the signature creation data was stored and affixed in such exclusive 
manner as may be prescribed. 

£Xp/allafion.-ln case of digital signature, the "signature creation data" means 
the private key of the subscriber. 

16. The Central Government may, for the purposes of sections 14 and IS, 
prescribe the security procedures and practices: 

Provided that in prescribing such security procedures and practices, the Central 
Government shall have regard to the commercial circumstances, nature of transactions 
and such other related factors as it may consider appropriate.'. 

12. In section) 7 of the principal Act.- 

(a) in sub-section (J), for the words "and Assistant Controllers", the words 
", Assistant Controllers, other officers and employees" shall be substiuted; and 

(b) in sub-section (.f), for the words "and Assistant Controllers", the words 
", Assistant Controllers, other officers and employees" shall be substituted ". 

13. Section 20 of theprmcrpal Act shall be omitted. 

14. In section 29 of the principal Act, in sub-section (I), for the words "any 
contravention of tbe provisions of this Act, rules or regulations made thereunder", the 
words "any contravention of the provisions of this Chapter" shall be substituted. 

15. in section 30 of the principal Act,- 

(I) in clause (c), after the word "assured", the word "and" shall be omitted; 
(;1) after clause (c), the following clauses shall be inserted, namely:- 

"("caj be the repository of all Electronic Signature Certificates issued under 
this Act; 

(cb) publish information regarding its practices. Electronic Signature 
Certificates and current status of such certificates; and". 

16.1n section 34 of the principal Act, in sub-section (I), in clause fOJ, the words "wbicb 
contains the public key corresponding to the private key used by that Certifying Authority 
to digitally sign another Digital Signature Certificate" shall be omitted. 

17. In section 35 of the principal Act, in sub-section (4), - 

(0) the first proviso sliall be omitted; 

(b) in the second proviso, for the words "Provided further", the word "Provided" 

shall be substituted. 

18. In section 36 of the principal Act, after clause (c), the following clauses shall be 
inserted, namely:- 

"(co) the subscriber holds a private key which is capable of creating a digital 

signature; 

(cb) the pubUc key to be Usted in the certificate can be used to verify s digital 
signature alTu:ed by the private key held by the subscriber;". 



Amendmenl 
of section 12 

SubstitutlOo of 
new sections 
for sections 
IS and 16. 

Secure 
eleetremc 

signature. 



Seeuril) 

proeedures lIDd 

PIllCHCCS 



Amendment of 
seeuoe 17. 



Omission of 
seeUon 20 



Amendment of 

secuen 29. 



Amendment of 
secnen 30. 



Amendment of 
secuen H . 



Amendment of 
section 3S 



Amendment c" 

seeuen 36. 



6 



THE GAZETTE OF INDIA EXTRAORDINARY 



[PART'U- 



19. After section 40 of the principal Act, the following section shall be inserted, 
namely:- 

"40A.ln respect of Electronic Signature Certificate the subscriber shall perform 
such duties as may be prescribed.". 



Amendmenl of 20. In Chapter DCof the principal Act, in the heading, for the words "penalties and 
huding of ADJUDICATIONHp words "PENALTIESpMPENSATiON ANP ADJUDICATICSBail be substituted. 

CbapUir IX. 

Amendment of 21. In section 43 of the principal Act,- 

seenen 43. ^j^^ marginal heading, for the word "Penalty", the words "Penalty and 

Compensaticn" shall be substituted; 

(b) in clause (0), after the words "computer network", the words "or computer 

resource" shall be inserted; 

(c) after clause (h), the following clauses shall be inserted, namely:- 

"(I) destroys, deletes or alters any information residing in a computer 
resource or diminishes its value or utility or atreets itinjuriouslyby any means; 

(J1 steal, conceals, destroys or alters or causes any person to steal, conceal, 
destroy or alter any computer source code used for a computer resource with an 

intention to cause damage;"; 

(d) for the portion begining with the words "he shall be hable to pay damages" 
and ending with the words "persons so affected" the following shall be substituted, 
namely:- 

"he shall be liable to pay damages by way of compensation to the person 
so affected"; 

(e) in the Explanation, after clause (iv), the following clause shall be inserted, 
namely:- 

'(v) "computer source code" means Ihe listing of programmes, computer 
commands, design and layout and programme analysis of computer resource in any 
form." 

Insertion of 22. After section 43 of the principal Act, the following section shall be inserted, 

Dcr section namely:- 

43A. 

'43A. Where a body corporate, possessing, dealing or handling any sensitive 
personal data or information in a computer resource which it owns, controls or operates, 
is negligent in implementing and maintaining reasonable security practices and 
procedures and thereby causes wrongfiil loss or wrongful gain 10 any person, such 
body corporate shall be liable 10 pay damages byway of compensation to the person 
so affected. 

uplanarian.-For the purposes of this section,- 

(/) "body corporate" means any company and includes a frnn, sole 
proprietorship o~ other association of individuals engaged lo commercial or 

professional activities: 

(ill "reasonable security practices and procedures" means security 
practices and procedures designed to protect such information from unauthorised 
access, damage, use, modification, disclosure or impairment, as may be specified 
in an agreement between the parties or as may be specified in any law for the lime 
being in force and in the absence of such agreement or any law, such reasonable 
security practices and procedures, as may be prescribed by the Central' 
Government in consultation with such professional bodies or associations as it 
may deem fit; 
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(rii) "sensitive persona! data or information" means sucli personal 
information as may be prescribed by ttie Central Government in consultation 
witti sucti professional bodies or associations as it may deem fit. ', 

23. In section 46 of the principal Act,- 

(0) in sub-section (I), for the words "direction or order made thereimder", the 
words "direction or order made thereunder which renders him liable to pay penalty or 
compensation." shall be substituted; 

(b) after sub-section (I), the following sub-section shall be inserted, namcly:- 

"(lA) The adjudicating officer appointed imder sub-section (I) shall 
exercise jurisdiction to adjudicate matters in which the claim for injury or damage 
does not exceed rupees five crore: 

Provided that the jurisdiction in respect of the claim for injury or damage 
exceeding rupees live crore shall vest with the competent court."; 

(c) in sub-section (5), after clause (b), the following clause shall be inserted, 
namely :- 

•'(C) shall be deemed to be a civil court for purposes of Order XXI of the 
Civil Procedure Code, 1908r. 

24. In Chapter X of the principal Act, in the heading, the word "regulations" shall be Amendment 

^^^^ HHH 

Chapter X 

25. In section 48 of the principal Act, in sub-section (I), the word "Regulations" shall Amendment 
be omitted. section 48 



26. For sections 4910 S2 of the principal Act, the following sections shall be substituted, 
namely:- 



"49. (I) The Cyber Appellate Tribunal shall consist ofa Chairperson and such 
number of other Members, as the Central Government may, by notification in the 
Official Gazette, appoint: 

Provided that the person appointed as the Presiding Officer of the Cyber Appellate 
Tribunal under the provisions of this Act immediately before the commencement of the 
Information Technology (Amendment) Act, 2008 shall be deemed to have been 
appointed as the Chairperson oflhe said Cyber Appellate Tribunal under the provisions 
of this Act as amended by the Information Technology (Amendmeot) Act, 2008. 

(2) The selection of Chairperson and Members oflhe Cyber Appellate Tribunal 
shall be made by the Central Government in consultation with the Chief Justice of 
India. 

(3) Subject to the provisions ofUii;; Act- 

(Oj the jurisdiction, powers and authority of the CyOOiAppellate Tribunal 
may be exercised by the Benches thereof; 

(b) a Bench may be constituted by the Chairperson of the Cyber Appellate 
Tribunal with one or two Members of such Tribimal as the Chairperson may 
deem fit; 

(c) the Benches oflhe Cyber Appellate Tribunal shall sit at New Delhi and 
at such other places as the Central Government may, in consultation with the 
Chairperson of the Cyber Appellate Tribunal, by notification in the Official Gazette, 
specify; 
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(d) the Central Government shall, by notifieation in the Offieial Gazette, 
specify the areas in relation to which each Bench oftheCyber Appellate Tribunal 
may exercise itsjurisdiction. 

(4) Notwithstanding anything contained in sub-section (3), the Chairperson of 
the Cyber Appellate Tribunal may transfer a Member of such Tribunalfrom one Bench 
to another Bench. 

(5) Ifat any stageofthe hearing of any case or matter it appears to the Chairperson 
or a Member of mc Cyber Appellate Tribunal that the case or matter is cfsuch a nature 
that it ought to be heard by a Bench consisting of more Members, the case or matter 
may be transferred by the Chairperson to such Bench as the Chairperson may deem fit. 

50. (J) A person shall not be qualified for appointment as a Chairperson o&he 
Cyber Appellate Tribunal unless he is, or has been, or is qualified £0 be, a Judge of a 
High Court. 

(2) The Members offhe Cyber Appellate Tribunal, except the Judicial Member to 
be appointed under sub-section (3), shall be appointed by the Central Government 
from amongst persons, having special knowledge of, and professional experience in, 
jnformation technology, telecommunication, industry, management or consumer affairs: 

Provided that a person shall not be appointed as a Member, unless he is, or has 

been, in the service of the Central Government or a State Government, and has held the 
post of Additional Secretary to the Government oflndia or any equivalent post in the 
Central Government or State Government for a period of not less than one year or Joint 
Secretary to the Government oflndia or any equivalent post in the Centtal Government 
or State Government for a period of not less than seven years. 

(J) The Judicial Members ofthe Cyber Appellate Tribunal shall be appointed by 

the Central Govemment from amongst persons who is or has been a member of the 
Indian Legal Service and has held the post of Additional Secretary fors period of not 
less than one year or Grade 1 post ofthal Service for a period of not less than five years. 

51 (I) The Chairperson or Member of the Cyber Appellate Tribunal shall hoJd 
office for a term offive years from the date 00 which he enters upon his office or until 
he attains the age of sixty- five years, whichever is earlier, 

(2) Before appointing any person as the Chairperson or Member of the Cyber 

Appellate Tribunal, the Central Government shall sarisfy itself that the person does 
not have any such financial or other interest as is likely to affect prejudicially his 
fimctions as such Chairperson or Member. 

(3) An officer ofthe Central Government or Stare Government on his selection as 
the Chairperson or Member of the Cyber Appellate Tribunal, as tbe case may be, shall 
have to retire from service before joining as such Chairperson or Member. 

52. The salary and allowances payable to, and the other terms and conditions of 

service including pension, gratuity and other retirement benefits of, tho Chairperson 
or a Member of th~Cyber Appellate Tribunal shall be such as may be prescribed. 



52A The Chairperson of the Cyber Appellate Tribunal shall have powers of 
general superintendence and directions In the conduct of the affairs of that Tribunal 
and he shall, in addition to presiding over the meetings of the Tribunal, exercise and 
discharge such powers and fimctions of the Tribunal as may be prescribed. 
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52B. Where Benches are constituted, the Chairperson of the Cyber Appellate 
Tribunal may, by order, distribute the business of that Tribunal amongst the Benches 
and also the matters to be dealt with by each Bench. 

52C. On the application of any of the parties and after notice to the parties, and 

after hearing such of them as he may deem proper to be heard, or suo motu without 
such notice, the Chairperson of the Cyber App-ellate Tribunal may transfer any case 
pending before one Bench, for disposal to any other Bench. 

520. If the Members ofa Bench consisting of two Members differ in opinion on 
any point, they shall state the point or points on which they differ, and make a reference 
to the Chairperson of the Cyber Appellate Tribunal who shall hear the point or points 
himself and such point or points shall be decided according to the opinion of the 
majority of the Members who have heard the case, including those who first heard it.". 

27. In section 53 of the pnncipal Act, for the words "Presiding Officer", the words 
"Chairperson or Member, as the case may be," shall be substituted. 

28. In section 54 of the principal Act, for the words "Presiding Officer" wherever they 
occur, the words "Chairperson or the Member" shall be substihited. 

29. In section 55 of the principal Act, for the words "Presiding Officer", the words 
"Chairperson or the Member" shall be substituted. 

30. In section 56 of the principal Act, for the words "Presiding Officer", the word 
"Chairperson" shall be substihited. 

31. In section 64 of the principal Act,- 

(/) for the words "penalty imposed", the words "penalty imposed or compensation 
awarded" shall be substituted; 

(;1) an the marginal heading, for the word "penalty", the words "penalty or 
compensation" shall be substihited. 

32. For sections 66 and 67 of the principal Act, the following sections shall be 
substituted, namely:- 
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'66.1f any person, dishonestly or fraudulently, c!oesany act referred to in section 43, Computer 
he shall be punishable with imprisonment for a term which may extend to three years or with "'^''^'^'^ 

offences 

fine which may extend to five lakb rupees or with both. 
Explanation -For the purposes of this section,- 

(a) the word "dishonestly" shall have the meaning assigned to it in section 24 
of the Indian Penal Code; 

(b) the word "fraudulently" shall have the meaning assigned to it in section 25 

of the Indian Penal Code. 

66A. Any person who sends, by means of a computer resource or a Punisimieni 

communication device, A *" scndmC 

offensive 

(a) any information that is grossly offensive or has menacing character; or messages 

Ihrou,h 

(b) any information which he knows to be false, but for the purpose of commumcanen 
causing annoyance, inconvenience, danger, obstruction, insult, injury, criminal service, ere 
intimidation, enmity, hatred or ill will, persistently by making use of such computer 

resource or a communication device; or 

(c) any electronic mail or electronic mail message for the purpose of causing 
annoyance or inconvenience or to deceive or to mislead the addressee or recipient 
about the origin of such messages. 
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shall be punishable with imprisomnent for a term which may extend to three years and 
with fine. 

Esplanation=« For the purposes of this section, tenus "electronic mail" and 
"electronic mail message" means a message or information created or transmitted or 
received on 8 computer, computer system, computer resource or communication device 
including attachments in text, image, audio, video and any other electronic record, 
which may be transmitted with the message. 

66B. Whoever dishonestly receives or retains any stolen computer.resource or 
communication device knowing or having reason to believe the same to be stolen computer 
resource or communication device, shall be punished with imprisonment of either description 
for a term which may extend to three years or with (inc which may extend to rupees one lakh 
or With both. 



66C. Whoever, fraudulently or dishonestly make use of the electronic signature, 
password or any other unique identification feature of any other person, shall be punished 
with imprisonment of either description for a term which may extend to three years and shall 
also be hable to fme which may extend to rupees one lakh. 

660. Whoever, by means of any communication device or computer resource cheats 

by personation, shall be punished with imprisonment of either description for a term which 
may extend to three years and shall also be liable to fme which may extend to one lakh rupees. 



Punishment for 
llioUllon of 
pUyacy 



Punishment 
for cyber 
terrorism 



66E. Whoever, intentionally or knowingly captures, publishes or transmits the image 
ofa private area ofany person without his or her consent, under circumstances violating the 

privacy of that person, shall be punished with imprisonment which may extend to three years 
or with fine not exceeding two lakh rupees, or with both. 

Explanalion.- For the purposes of Diis section- 

(a) "transmit" means to electronically send a visual image with the intent that it 

be viewed by a person or persons; 

(b) "capture", w<ithrespect to an image, means to videotape, photograph, film or 
record by any means; 

(0) "private area" means the naked or undergarment clad genitals, public area, 
bullocks or female breast; 

(d) "publishes" means reproduction in the printed or electronic form and making 
it available forpubhc; 

(e) "under circumstances violating privacy" means circumstances in which a 
person can have a reasonable expectation that- 

(I) he or ,he could disrobe in privacy, without being concerned that an 

image of his private area was being captured; or 

(il) any part of his or her private area would not be visible to the public, 
regardless of whether that person is in a public or private place. 

66P. (I) Whoever,- 

(,4) ...~th intent to threaten the unity, integrity, security or sovereignty of India or 
10 strike terror in the people or any section of the people by- 

(,) denying or cause the denial of access to any person authorised to 
access computer resource; or 
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(ir) attempting to penetrate or access a computer resource without 
authorisation or exceeding authorised access; or 

(HI) introducing or causing to introduce any computer contaminant, 

and by means of such conduct causes or is likely to cause death or injuries to persons 
or damage to or destrucuon of property or disrupts or knowing that it is likely to cause 

damage or disruption of supplies or services essential to the life of the community or 
adversely affect the critical information infrastructure specified under section 70; or 

(B) knowingly or intentionally penetrates or accesses a computer resource without 
authorisation or exceeding authorised access, and by means of such conduct obtains 
access 10 information, data or computer database thai is restricted for reasons of the 
security of the Stale or foreign relations; or any restricted information, data or 
computer database, with reasons to beUeve that such information, data or computer 
database so obtained may be used to cause or likely to cause injury to the interests of 
the sovereignty and integrity oflndia, the security of the State, friendly relations with 
foreign States, public order, decency or morality, or in relation to contempt of court, 
defamation or incitement to an offence, or to the advantage of any foreign nation, 
group of individuals or otherwise, 

commits the offence of cyber terrorism. 

(2) Whoever commits or conspires to commit cyber terrorism shall be punishable with 
imprisonment which may extend to imprisonment for hfe. 

67. Whoever publishes or transmits or causes to be published or transmitted in 
the electronic form, any material which is lascivious or appeals to the prurient interest 
or If Its effect is such as to tend to deprave and corrupt persons who are likely, having 
regard to all relevant circumstances, to read, see or hear the matter contained or embodied 
in it, shall be punished on first conviction with imprisonment of cither description for 
a term which may extend to three years and with fine which may extend to five lakh 
rupees and in the event of second or subsequent conviction with imprisonment of 
either description for a term which may extend to five years and also with fine which 
may extend to ten lakh rupees. 

67 A. Whoever publishes or transmits or causes to be pubhshed or transmitted 
in the electronic form any material which contains sexually exphcit act or conduct shall 
be punished on first conviction with imprisonment of either description for a term 
which may extend to five years and with fine which may extend to len lakh rupees and 
in the event of second or subsequent con viction with unprlsonment of either description 
for a term which may extend to seven years and also with fme which may extend to ten 
lakh rupees. 

678. Whoever,- 

(a) publishes or transmits or causes to be published or transmitted material in 
any electronic form which depicts children engaged in sexuallyexplicit act or conduct; 

M 

(b) creates text or dig\taj images, collects, seeks, browses, downloads, advertises, 
pro motes, exchanges or distributes material in any electronic form depicting children 
in obscene or indecent or sexually explicit manner; or 

(c) cultivates, entices or induces children to online relationship with one or more 
children for and on sexually explicit act or in a manner that may offend a reasonable 
adult on the computer resource; or 

(d) facilitates abusing children online; or 

(c) records in any electronic form ovm abuse or that of others pertaining to 
sexually explicit act with children. 
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shall be punished on first conviction with imprisonment of either description for a term which 
may extend to five years and with fine which may extend to ten lakh rupees and in the event 

of second or subsequent conviction with imprisonment of either discription for a term which 
may extend to seven years and also with fine which may extend to ten lakh rupees: 

Provided that provisions of section 67, section 67 A and this section does not 
extend to any book, pamphlet, paper, writing, drawing, painting representation or 
figure in electronic fonn- 

f/j the publication of which is proved to be justified as being for the public 
good on the ground that such book, pamphlet, paper, writing, drawing, painting 
representation or figure is in the interest of science, literature, art or leaming or 
other objects of general concern: or 

(N) which is kept or used for bona fide heritage or rehgious purposes. 

F..'(planaflofl- For the purposes of this section, "children" means a person 

who has not completed the age of 18 years. 

67C. (1) intermediary shall preserve and retain such information as may be 
specified for such duration and in such manner and format as the Central Government 
may prescribe. 

(2) An)' intermediary who intentionally or knowingly contravenes the provisions 
of sub-section (J) shall be punished with an imprisonment for 8 term which may extend 
to three years and shall also be liable to fine. '. 

33. In section 68 of the principal Act, for sub-section (1), the following sub-section 
shall be substituted, namely.-> 

"(2) Any person who intentionally or knowingly fails to comply with any order 
under sub-section (I) shall be guilty of an offence and shall be hable on conviction to 
imprisonment for a term not exceeding two years or a fine not exceeding one lakh 
rupees or with both,", 

34. For section 69 of the principal Act, the following sections shall be substituted, 
namely:- 
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'69. (/) Where the Central Government or a State Government or any ofits officers 
specially authorised by the Central Government or the State Government, as the case may be, 
in this behalf may, ifsatisfied that it is necessary or expedient so JD do, in the interest of the 
sovereignty or integrity of India, defence of India, security of the State, friendly relations 
with foreign States or public order or for preventing incitement to the commission of any 
cognizable offence relating io above or for investigation of any offence, it may subject to the 
provisions of sub-section (2), for reasons to be recorded in writing, by order, direct any 
agency of the appropriate Government to intercept, monitor or decrypt or cause to be 
intercepted or monitored or decrypted any information generated, transmitted, received or 
stored in any computer resource. 

(2) The procedure and safeguards subject to which such interception or monitoring or 
decryption may be carried out, ~haH be such as may be prescribed. 

(3) The subscriber or intermediary or any person in-charge of the computer resource 
shall, when called upon by any agency referred to in sub-section (/), extend all facilities and 
technical assistance 1 0- 

(a) provide access to or secure access to the computer resource generating, 
transmitting, receiving or storing such information; or 

(b) intercept, monitor, or decrypt the information, as the case may be; or 

(c) provide mformation stored in computer resource. 
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(.f) The subscriber or intermediary or any person who fails to assist the agency referred 
to in sub-section (3) shall be punished with imprisonment for a term which may extend to 
seven years and shall also be liable to fine. 

69A. (I) Where the Central Government or any of its officers specially authorised by it 
in this behalf is satisfied that it is necessary or expedient so to do, in the interest ofsovereignty 
and integrity oflndia, defence of India, security of the State, friendly relations with foreign 
States or pubhc order or for preventing incitement to the commission of any cognizable 
offence relating to above, it may subject 10 the provisions of sub-section (2), for reasons to 
be recorded in writing, by order, direct any agency of the Government or intermediary to 
block for access by the pubhc or cause to be blocked for access by the public any information 
generated, transmitted, received, stored or hosted in any computer resource. 

(2) The procedure and safeguards subject to which such blocking for access by the 
pubhc may be carried out, shall be such as may be prescribed. 

(3) The intermediary who Hills to comply With the direction Issued under sub-section 
(I) shall be punished with an imprisonment for a term which may extend to seven yeats and 
shall also be liable to fme. 

698. (1) The Central Government may, to enhance cyber security and for identification, 

analysis and prevention of intrusion or spread of computer contaminant in the country, by 
notification in the Official Gazelle, authorise any agency of the Government to monitor and 
collect traffic data or information generated, transmitted, received or stored in any computer 



(2) The intermediary or any person in-charge or the computer resource shall, when 
called upon by the agency which has been authorised under sub-section (/), provide technical 
assistance and extend all facilities to such agency to enable online access or io secure and 
provide online access to the computer resource generating, transmitting, recel ving or storing 
such traffic data or information. 

(3) The procedure and safeguards for monitoring and collecting traffic data or 

information, shall be such as may be prescribed 

(4} Any intermediary who intentionally or knowingly contravenes the provisions of 
sub-section (2) shall be punished with an imprisonment for a term which any extend to three 
years and shall also be liable to fme. 

Explanotion.-For the purposes of this seciion.e- 

(,) "computer contaminant" shall have the meaning assigned to it in section 43; 

(il) "traffic data" means any data identifying or purporting to identify any person, 
computer system or computer network or location to or from which the communication 
is or may be transmitted and includes communications origin, destination, route, time, 
date, size, duration ojtype of underlying service and any other information.'. 

35. In section 70 of the principal ACl.- 

(0) for sub-section (I), the following sub-section shall be substituted, 
namely:- 

'(1) The appropriate Government may, by notification in the Official Gazette, 
declare an) computer resource which directly or indirectly affects the facility of 
Criticalhiformation Infrastructure, to be a protected system 

Explanotion.-For the purposes of this section, "Critical Information 
Infrastructure" means the computer resource, the mcapacitation or destruction 
of which, shall have debilitating impact on national security, economy, public 
health or safety ': 
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(b) after sub-section (3), the following sub-section shall be inserted, namely:- 

"(4) The Central Government shall prescribe the information security 
practices and procedures for such protected system.". 

Insertion of 36. After sectjon 70 of the principal Act, the following sections shall be inserted, 

newseeuons namely :- 

lOA and 708 
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"70A. (l)The Central Government may, by notification published in the Official 
Gazette, designate any organisation of the Government as the national nodal agency 
in respect ofCriticaJ Information Infrastructure Protection. 

(2) The national nodal agency designated UDder sub-section (1) shall be 
responsible for all measures including Research and Development relating to 
protection of Critical Information Inlrastructure. 

(3) The manner of performing functions and duties of the agency referred to In 
sub-section (1) shall be such as may be prescribed. 

70B. (J) The Central Government shall, by notification in the Official Gazene, 
appoint an agency of the Government to be called the Indian Computer Emergency 
Response Team. 

(2) The Central Government shall provide the agency referred to in sub-section 
(I) with a Director-General and such other officers and employees as may be prescribed 

(3) The salary and allowances and terms and conditions of the Director-General 
and other officers and employees shall be such as may be prescribed. 

(4) The Indian Computer Emergency Response Team shall serve as the national 
agency for performing the following functions in the area of cyber security ,- 

(a) ccUecuon, analysis and dissemination of Information on cyber 
incidents; 

(b) forecast and alerts of cyber security incidents; 

(c) emergency measures for handling cyber security incidents; 

(d) cxjordrnaticn of cyber incidents response activities; 

(e) issue guidelines, advisories, vulnerabihty notes and whitepapcrs 
relating to information security practices, procedures, preventation, response 
and reporting of cyber incidents; 

if) such other fimctions relating to cyber security as may be prescribed. 

(5) The manner of performing functions and duties oftbeagency referred to in 
sub-section (1) shall be such as may be prescribed. 

(6) For carrying out the provisions of sub-section (4), the agency referred to in 
sub-section (/) may call for information and give direction to the service providers, 
intermediaries, data centr-, body corporate and any other person. 

(7) Any service provider, intermediaries, data centres, body corporate or person 
who fails to provide the information called for or comply with the direction under sub- 
section (6), shall be punishable with imprisonment for iiterm which may extend to one 
year or with fme which may extend to one lakh rupees or with both. 

(8) No court shall take cognizance of any offence under this section, except on 
a complaint made by an officer authorised in this behalf by the agency referred to in 
sub-section (/) ". 
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37. After section 72 of the principal Act, the following section shall be inserted, 
namely:- 

U72A. Save as otherwise provided in this Act or any other law for the time being 
in force, any person including an intermediary who, while providing services under the 
terms of lawful contract, has secured access to any material containing personal 
information about another person, with the intent to cause or knowing that he is likely 

to cause wrongful Joss or wrongful gain discloses, withoutlhe consent of the person 
concerned, or in breach ofa lawful contract, such material 10 any other person, shall 
be punished with imprisonment for a term wnlch may extend to three years, orwithfine 
which may extend to five lakb rupees, or with both.". 

38. For section 77 of the principal Act, the following sections shall be substituted, 
namely:- 
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"77. No compensation awarded, penally imposed or confiscation made under 
this Act shall prevent the award of compensation or imposition of any other penalty or 
punishment under any other law for the time being in force. 
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77A. A court of competent jurisdiction may compound offences, other than Compounding 
offences for which the punishment for life or imprisonment for ll term exceeding three of offences, 
years has been provided, under this Act: 

Provided that the court shill Inot compound such offence where the accused is, 
by reason of his previous conviction, liabJe to either enhanced punishment or to a 
punishment of a different kind: 

Provided further that the court shall not compound any offence where such 
offence affects the socio economic conditions of the country or has been committed 
against a child below the age of 18 years or ii woman. 

(2) The person accused of an offence under this Act may file an application for 
compounding in the court in which offence is pending for trial and the provisions of 
sections 265B and 26SC of the Code of Criminal Procedure, 1973 shall apply. 



77B. Notwithstanding anything contained in the Code of Criminal Procedure, 

1973, the offence punishable with imprisonment of three years and above shall be 
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39. 10 section 78 of the principal Act, for the words "Deputy Superintendent 
Pohce" the word "Inspector" shall be substituted. 



of 
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40. For Chapter XU of the principal Act, the following Chapters shall be substituted, SubstiiuiioD of 
namely:- "s* chapters 

for Chapter Y.ll. 

'CHAPTER XII 

blTERMEDIAtJES NOT TO BE LIABLE IN CERTAIN CASES 

79. (1) Notwithstanding anything contained in any law for the time being in force 
but subject to the provisions of sub-sections (2) and (3), an intermediary 
shall not be liable for any third party information, data, or communication link made 

available or hosted by him. 

(2) The provisions of sub-section (I) shall apply if- 

(a) the function of the intermediary is limited to providing access to a 
communication system over which information made available by third parties is 
transmitted or temporarily stored or hosted; or 
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(b) the intermediary does not- 

(I) initiate the transmission, 

(i/) select the receiver of the transmission, and 

(ill) select or modify the information contained in the transmission; 

(c) the intermediary observes due diligence while discharging his duties 
under this Act and also observes such other guidelines as the Central 
Government may prescribe in this behalf. 

(3) The provisions of sub-seetlon (1) shall not apply if- 

(0) the intermediary has conspired or abetted or aided or induced, whether 
by threats or promise or otherwise in the commission of the unlawful act; 

(b) upon receiving actual knowledge, or on being notified by the 
appropriate Government or its agency that any information, data or 
communication link residing in or connected to a computer resource controlled 
by the intermediary is being used to commit the unlawful act, the intermediary 
fails to expeditiously remove or disable access to that material on that resource 
without vitiating the evidence in any manner. 

Explanotion.-For the purposes of this section, the expression "third party 
information" means any information dealt with by an intermediary in his capacity as an 
intermediary. 

CHAPTER XllA 
EXAMINER or UtECTRONIC EVIDENCE 

I, 

79A. The Central Government may, for the purposes of providing expert opinion 
on electronic form evidence before any court or other authority specify, by notification 
in the Official Gazette, any Department, body or agency of the Central Government or 
a State Government as an Examiner of Electronic Evidence. 

Explanation.-Por the purposes of this section, "electronic form evidence" 
means any information of probative value that is either stored or transmitted in electronic 
form and includes computer evidence, digital audio, digital video, cell phones, digital 
fax machines,'. 

41. In section 80 of the principal Act, in SUb-section (I), for the words "Deputy 
Superintendent of Pol ice", the word "Inspector' shall be substituted. 

42. In section 81 of the principal Act, the following proviso shall be inserted at the end, 
namely :- 

"Provided that nothing contained in this Act shall restrict any person from 
exercising any right conferred under the Copyright Act, 1957 or the Patents Act, 1970.". 

43. In section 82 of the principal ACt,- 

(0) for the marginal heading, the following marginal heading shall besubstitmed, 
namely:- 

"Chairperso-, Members, officers and employees to be pubUc servants."; 

(b) for the words "Presiding Officer", the words "Chairperson, Members" shall 
be substituted. 

44. In section 84 of the principal Act, for the words "Presiding Officer", the words 
"Chairperson, Members" shall be substituted. 

45. After section 84 of the principal Act, the following sections shall be inserted, 
namely: - 
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"84A. The Central Government may, for secure use of the electronic medium and Modes or 
for promotion of e-govemance and e-commerce, prescribe the modes or methods for methods for 
encryption. encrypuon 



848. Whoever abets any offence shall, if the act abetted is committed in 
consequence of the abetment, and no express provision is made by this Act for the 
punishment of such abetment, be punished with the pumshmem provided for the 
offence under this Act 

Explanation. -An act or offence is said to be committed in consequence of 
abetment, when it is committed in consequence of the instigation, or in pursuance of 
the conspiracy, or with the aid which constitutes the abetment 

84C. Whoever attempts to commit an offence punishable by this Act or causes 
such an offence to be committed, and in such an attempt does any act towards the 
commission of the offence, shall, where no express provision is made for the punishment 
of such attempt, be punished with imprisonment of any description provided for the 
offence, for a term which may extend to one-half ofthc longest term of imprisonment 
provided for that offence, or with such fine as is provided for !he offence, or with both." 

46. In section 87 of tile principal Act,- 

(A) in sub-section (1),- 

(I) for clause (a), the following clauses shall be substituted, nomely:- 

"(a) the conditions for considering reliability of electronic signature 
or electronic authentication technique under sub-section (1) of 
section 3A; 

(oa) the procedure for ascertaining electronic signature or 
authentication under sub-section (3) of section 3A; 

(ab) the marmer in which any information or matter may be 
authenticated by means of electronic signature under section 5;"; 

(II) after clause (c), the following clause shall be inserted, namely:- 

"(co) the tnal\llerin which the authorised service provider may collect, 
retain and appropriate service charges under sub-section (2) of 
section 6A;"; 

(iii) for clause (e), the foUovdng clauses shall be substituted, namely:- 

tree) the manner of storing and affixing electronic signature creation 
data under section 15; 

(ea) the security procedures and practices under section 16;"; 

(ill) in clause (f), for the words "and Assistant Controllers", the words 
", Assistant Controllers, other officers and employees" shall be substituted; 

(II) clause (g) shall be omitted; 

(Vi) after clause (m), the following clause shall be inserted, namely:- 

"(ma) the form of application and fee for issue ofElectronic Signature 
Certificate under section 35;"; 

(vil) after clause (0), the foUovmg clauses shall be inserted, namely:- 
"(00) the duties of subscribers under section 40A; 
(ob) the rksonable security practices and procedures and sensitive 

personal data or information under section 43A;"; 

(vi/I) in clause (r), for the words "Presiding Officer", the words "Chairperson 
and Members" shall be substituted; 

(a) in clause ($), for the words "Presiding Officer", the words "Chairperson 
and Members" shall be substituted; 

(x) for clause (\r), the following clauses shall be substituted, namely:- 
hew) the powers and Sanctions of the Chairperson of the Cyber 

Appellate Tribunal under section 52A; 
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(x) the information, duration, manner and form of such Informauon 

to be retained and preserved under section 67C; 

(y) the procedures and safeguards for interception, monitoring, or 
decryption under sub-section (2) of section 69; 

(z) the procedure and safeguards for blocking for access by the 
public under sub-section (2) of section 69A; 

(zo) the procedure and safeguards for monitoring and collecting 
traffic data or information under sub-section (3) of section 69B; 

(zb) the information security practices and procedures for protected 
system under section 70; 

(zc) manner of performing functions and duties of the agency under 
sub-section (3) of section 70A; 

(zd) the officers and employees under sub-section (2) of section 

70B; 

(ze) salaries and allowances and terms and conditions of service of 
the Director General and other officers and employees under sub- 
section (3) of section 70B; 

(rj) the mariner inwhcih the fiinctions and duties of agency shall be 
performed under sub-section (5) of section 70B, 

(zg) the guidelines to be observed by the intermediaries under 
sub-section (2) of section 79; 

(=11) the modes or methods for encryption under section 84A;"; 
(8) in sub-section (3).- 

(I) for the words, brackets, letter and figures "Every notification made by 
the Central Government under clause (/) of sub-section (4) of section 1 and 
every rule made by if, the words "Every notification made by the Central 
Government under sub-section (1) of section 70A and every rule made by 
it" shall be substituted; 

(if) the words "the notification or" wherever they occur, shall be omitted. 

Amendment 47.1n section 90 of the principal Act, in sub-section (1), clause (c) shall be omitted . 

ofsecuen 90. 

Onussion of 48. Sections 91,92,93 and 94 of the principal Act shall be omitted. 
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49. For the First Schedule and the Second Schedule to the principal Act, the following 
Schedules shall be substituted, namely:- 

"FIRST SCHEDULE 
[See sub-section (4) of section iJ 

DOCUMENTS OR TRANSACTIONS TO WHICH THE ACT SHAIL NOT APPLY 
SI.No. qescription of documents or transactions 

1. A negotiable inseumem (other thall a cheque) as defined in section 13 of the Negotiable 
Instruments Act, 1881. 26 of I88I. 

2. A pcwer-of-attomey as defined in section lA of the Powers-of-Anomey Act, 1882. 7 of 1882 

3. A trust as defined in section 3 of the Indian Trusts Act, 1882. 2 of 1882 

4. A will as defined in clause (h) of section 2 of the Indian Succession Act, 1925, 39 Qf 1925 
including any other testamentary disposition by whatever name called. 

5. Any contract for the sale or conveyance of immovable property or any interest in 
such property. 
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THE SECOND SCHEDULE 
[See sub-section (1) of section 3 A] 

EUICTRONIC SIGNATURE OR BLECTRONtC AUTHEI-TICATION TECHNIQUE AND PROCEDURE 

SI.No. Description Procedure 

(1) (2) (3) 



II 



-J of 1860. 



21 of 2000 



50. The Third Schedule and the Fourth Schedule to the principal Act shall be omitted. 

PARrill 

AMeNDMeNT OFTIfE fNOIAH PEN.ALC0DE 

5/. .In the Indian Penal Code- 



(0) insertion 4,- 

(I) after clause (2), the following clause shall be inserted, namely:- 

"(3) any person in any place without and beyond India committing 
offence targeting a computer resource located in India."; 

(i/) for the Explanation, the following Explanation shall be substituted, 
namely:- 

Exp/anolion.-ln this section- 

(a) the word "offence" includes every act committed outside 
India which, ifcommiued in India, would be punishable under this 
Code; 

(b) the expression "computer resource" shall have the meaning 
assigned to it in clause 6X) of sub-section (/) of section 2 of the 
Informacion Technology Act, 2000. '; 

{b) Insertion 40, in clause (2), after (he figure "117", the figures and word "118, 

It 9 and 120" shall be Inserted; 

(c) in section 118, for file words "voluntarily conceals, by any act or illegal 
omission, the existence of a design", the words "voluntarily conceals by any act or 
omission or by the use of encryption or any other information hiding tool, the existence 
of a design" shall be fubslituted; 

(d) in section 1 19, for the words "voluntarily conceals, by any art or illegal 
omission, the existence of a design", the words "voluntarily conceals by any act or 
omission orby the use of encryption or any other information hiding looi, [he existence 
of a design" shall be substituted; 

(e) in section 464, for the words "digital signature" wherever they occur, the 
Words "electronic signature" shall be substituted; 
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PARTN 

AMEI'>DMENT OF THE. INDIAN EVIDEI'iCE Aer, 1872 

52. In the Indian Evidence Act, 1872,- i of 1872 



(0) in section 3 relaung to interpretation clause, in the paragraph appearing at 
the end, for the words "digital signature" and "Digital Signature Oertificate", the words 
"electronic signature" and "Electronic Signature Certificate" shall respectively be 
substituted, 

(b) after section 4S, the following section shall be inserted, namely:- 



"4SA. When in a proceeding, the court has to form an opinion on any 
matter relating to any information transmitted or stored in any computer resource 
or any other electronic or digital form, the opinion of the Examiner of Electronic 
Evidence referred to in section 79A of the Information Technology Act, 2000, is 21 of 2000. 
a relevant fact, 

E;r;plonofion.-For the purposes of this section, an Examiner of 
Electronic Evidence shall be an expert."; 

(c) in section 47A.- 

(I) for me words "digital signature", the words "electronic signature" 
shall be substituted; 

(II) for the words "Digital Signature Certificate", the words "Electronic 
Signature Certificate" shall be Substituted. 

(d) in section 67 A, for tlie words "digital signature" wherever they occur, the 
words "electronic signature" shall be substituted; 

(e) in section SSA, for the words "digital signature" at both the places where 
they occur, the words "electromc signature" shall be substituted; 

(f) in section 858, for the words "digital signature" wherever they occur, the 
words "electronic signature' shall be substituted; 

(g) in section 8SC. for the words "Digital Signature Certificate", the words 
"Electronrc Signature Certificate" shall be substituted; 

(II) i~section 90A, for the words "digital signature" at both the places where 
they occur, the words "electronic signature" shall be substituted; 



T. K.VISWANATHAN, 
Seq to the Govt of India 



COIUUGENDUM 

to 

THE INDIAN BOILERS (AMENDMENT) ACT, 2007 
(No. 49 of 2007) 

In the Indian Boilers (Amendment) ACi, 2007 (No. 49 of 2007), as pubhshed in the 
Gazette of India, Extraordinary, Pan II, Section I, dated the December 13,2007 (Issue No. 
56),- 

Atpage 6, line 17,[or"(6)", read"(SA)". 
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